Jackson 3.0.0 default for DeserializationFeature.FAIL_ON_TRAILING_TOKENS

[cowtowncoder]

(part of #72 uber-Discussion)

As of Jackson 2.x, DeserializationFeature.FAIL_ON_TRAILING_TOKENS defaults to false for backwards-compatibility. A suggestion has been made:

FasterXML/jackson-databind#3406

to change it to true instead, to help catch invalid content being sent.
We cannot make the change in Jackson 2.x, but could change it for 3.0.0.

So let's see if there is consensus on whether to make proposed change.

[JooHyukKim]

Voted true. IMHO, it's about

• true : being more secure (no vulnerability)
• false : being more reliable (no failed requests)

... these, then security matters more these days.

[cowtowncoder]

Hmmh. Ok, results are clear but number of votes could be higher. Will leave open for now.

[hho]

I also voted true. I don't think Postel's Law really applies here, and RFC 9413 explains it way better than I can.

[cowtowncoder]

I think we can now decide in favor of change: will update main page, approve FasterXML/jackson-databind#3406.